User (public visibility) login can be listed on the &#34;explore user&#34; page by &#34;Recently Updated&#34; #12541

@inferenceus commented on GitHub (Feb 26, 2024):

As an update to this issue, I was informed by Forgejo developers that logging in updates the updated_unix field. Isn't that a privacy leak itself? I don't believe logging in should expose user activity, since it pretty much equals the fact they're doing something.

As for logging in, that's still uncertain as I've been able to achieve the same results just by refreshing the page. Either way, now that it's been mentioned to me, I think it's wrong for it to be handled that way. Logging in should not be exposed to non-admins.

@inferenceus commented on GitHub (Feb 26, 2024): As an update to this issue, I was informed by Forgejo developers that logging in updates the `updated_unix` field. Isn't that a privacy leak itself? I don't believe logging in should expose user activity, since it pretty much equals the fact they're doing something. As for logging in, that's still uncertain as I've been able to achieve the same results just by refreshing the page. Either way, now that it's been mentioned to me, I think it's wrong for it to be handled that way. Logging in should not be exposed to non-admins.

GiteaMirror commented

@wxiaoguang commented on GitHub (Feb 26, 2024):

Thank you for your report. If you would like to discuss with Forgejo, you could use their issue tracker. I will update the issue report to remove unrelated contents.

Let's focus on Gitea in this space. If you really care about Privacy, you could set your visibility to Private.

@wxiaoguang commented on GitHub (Feb 26, 2024): Thank you for your report. If you would like to discuss with Forgejo, you could use their issue tracker. I will update the issue report to remove unrelated contents. ---- Let's focus on Gitea in this space. If you really care about Privacy, you could set your visibility to Private. ![image](https://github.com/go-gitea/gitea/assets/2114189/91602789-d88c-4cbf-ad37-62a104ffcdd8) ![image](https://github.com/go-gitea/gitea/assets/2114189/8f503292-99b5-4ef6-aef5-b1e351ba8955)

GiteaMirror commented

@inferenceus commented on GitHub (Feb 26, 2024):

Thank you for your report. If you would like to discuss with Forgejo, you could use their issue tracker. I will update the issue report to remove unrelated contents.

If you had read my issue, you would have seen that this affects Gitea exactly the same. It's not Forgejo-specific.

Let's focus on Gitea in this space.

It affects Gitea.

If you really care about Privacy, you could set your visibility to Private.

I care about privacy. Logging in is not something the world needs to know, but there are public repositories I want them to see.

The attitude shown here makes me glad I did switch. This was a terrible response to a privacy issue. Feel free to lock this as I don't believe Gitea cares at all based on what was said. You shouldn't talk down to people as if they're stupid.

@inferenceus commented on GitHub (Feb 26, 2024): > Thank you for your report. If you would like to discuss with Forgejo, you could use their issue tracker. I will update the issue report to remove unrelated contents. If you had read my issue, you would have seen that this affects Gitea exactly the same. It's not Forgejo-specific. > Let's focus on Gitea in this space. It affects Gitea. > If you really care about Privacy, you could set your visibility to Private. I care about privacy. Logging in is not something the world needs to know, but there are public repositories I want them to see. The attitude shown here makes me glad I did switch. This was a terrible response to a privacy issue. Feel free to lock this as I don't believe Gitea cares at all based on what was said. You shouldn't talk down to people as if they're stupid.

GiteaMirror commented

2025-11-02 10:13:24 -06:00

@wxiaoguang commented on GitHub (Feb 26, 2024):

The attitude shown here makes me glad I did switch. This was a terrible response to a privacy issue. Feel free to lock this as I don't believe Gitea cares at all based on what was said. You shouldn't talk down to people as if they're stupid.

Thank you for your report. But you never mentioned that you must keep your account as public visibility, right?

Since you have switched, so feel free to stay with Forgejo and tastes their bugs .....

@wxiaoguang commented on GitHub (Feb 26, 2024): > The attitude shown here makes me glad I did switch. This was a terrible response to a privacy issue. Feel free to lock this as I don't believe Gitea cares at all based on what was said. You shouldn't talk down to people as if they're stupid. Thank you for your report. But you never mentioned that you must keep your account as public visibility, right? Since you have switched, so feel free to stay with Forgejo and tastes their bugs .....

GiteaMirror commented

@inferenceus commented on GitHub (Feb 26, 2024):

But you never mentioned that you must keep your account as public visibility, right?

If it wasn't clear enough by the description, I am well aware the option exists. I already have users who do use this feature.

Since you have switched, so feel free to stay with Forgejo and tastes their bugs .....

You mean the bugs they have fixed and you haven't? This is a bug itself, and you're not even considering it; they are. The previous security stance by Gitea has always been terrible, and now you make people pay just for proper security notices. No, thanks. That's all from me. I made the correct decision. For-profit always ends this way.

@inferenceus commented on GitHub (Feb 26, 2024): > But you never mentioned that you must keep your account as public visibility, right? If it wasn't clear enough by the description, I am well aware the option exists. I already have users who do use this feature. > Since you have switched, so feel free to stay with Forgejo and tastes their bugs ..... You mean the bugs they have fixed and you haven't? This is a bug itself, and you're not even considering it; they are. The previous security stance by Gitea has always been terrible, and now you make people pay just for proper security notices. No, thanks. That's all from me. I made the correct decision. For-profit always ends this way.

GiteaMirror commented

2025-11-02 10:13:24 -06:00

@wxiaoguang commented on GitHub (Feb 26, 2024):

To address the privacy concern, I opened a new issue for it:

-> Don't update user's last login time to avoid being listed on the explore page #29428

@wxiaoguang commented on GitHub (Feb 26, 2024): To address the privacy concern, I opened a new issue for it: -> Don't update user's last login time to avoid being listed on the explore page #29428

GiteaMirror commented

2025-11-02 10:13:24 -06:00

@inferenceus commented on GitHub (Feb 26, 2024):

To address the privacy concern, I opened a new issue for it:

-> Don't update user's last login time to avoid being listed on the explore page #29428

Well, that's surprising. However, your attitude is not, and is unacceptable. I won't be contributing to anything related to Gitea at this point.

@inferenceus commented on GitHub (Feb 26, 2024): > To address the privacy concern, I opened a new issue for it: > > -> Don't update user's last login time to avoid being listed on the explore page #29428 Well, that's surprising. However, your attitude is not, and is unacceptable. I won't be contributing to anything related to Gitea at this point.

GiteaMirror commented

@wxiaoguang commented on GitHub (Feb 26, 2024):

But you never mentioned that you must keep your account as public visibility, right?

If it wasn't clear enough by the description, I am well aware the option exists. I already have users who do use this feature.

That's pretty clear now, so I think the concern could be addressed.

Since you have switched, so feel free to stay with Forgejo and tastes their bugs .....

You mean the bugs they have fixed and you haven't? This is a bug itself, and you're not even considering it; they are. The previous security stance by Gitea has always been terrible, and now you make people pay just for proper security notices. No, thanks. That's all from me. I made the correct decision. For-profit always ends this way.

Well, Forgejo doesn't really understand the security problems, for example, they didn't cherry pick some security fixes and expose the end users to potential risks. But I can't say too much publicly.

For the bugs ... I mean various bugs .... I read Forgejo PR frequently, I can see many of them has various problems ....

You could evaluate them by yourself ..... https://github.com/go-gitea/gitea/pulls?q=is%3Apr+author%3Aearl-warren+is%3Aunmerged+is%3Aclosed

@wxiaoguang commented on GitHub (Feb 26, 2024): > > But you never mentioned that you must keep your account as public visibility, right? > > If it wasn't clear enough by the description, I am well aware the option exists. I already have users who do use this feature. > That's pretty clear now, so I think the concern could be addressed. > > Since you have switched, so feel free to stay with Forgejo and tastes their bugs ..... > > You mean the bugs they have fixed and you haven't? This is a bug itself, and you're not even considering it; they are. The previous security stance by Gitea has always been terrible, and now you make people pay just for proper security notices. No, thanks. That's all from me. I made the correct decision. For-profit always ends this way. Well, Forgejo doesn't really understand the security problems, for example, they didn't cherry pick some security fixes and expose the end users to potential risks. But I can't say too much publicly. For the bugs ... I mean various bugs .... I read Forgejo PR frequently, I can see many of them has various problems .... You could evaluate them by yourself ..... https://github.com/go-gitea/gitea/pulls?q=is%3Apr+author%3Aearl-warren+is%3Aunmerged+is%3Aclosed

GiteaMirror commented

@jolheiser commented on GitHub (Feb 26, 2024):

@wxiaoguang please refrain from interacting further, this is not a good conversation.

@inferenceus based on the initial report, it seems partially solved by setting activity to private. But the leak is that participating in private actions still updates "recently updated"?
Does the new issue that was opened cover your follow-up comment?

@jolheiser commented on GitHub (Feb 26, 2024): @wxiaoguang please refrain from interacting further, this is not a good conversation. ---- @inferenceus based on the initial report, it seems partially solved by setting activity to private. But the leak is that participating in private actions still updates "recently updated"? Does the new issue that was opened cover your follow-up comment?

GiteaMirror commented

@wxiaoguang commented on GitHub (Feb 26, 2024):

Hopefully won't bother you, but for the whole context, I'd like to say something more (so I started a new comment).

First, I sincerely apologize to you for the wording making your unhappy / uncomfortable.

Some details:

For the issue report: as you know, Forjoge doesn't have a good relation with Gitea, neither with me. Some Forgejo people created too many lies. So, in Gitea space, many Forgejo related topics are difficult to continue. That's why I suggested that "Let's focus on Gitea"
Since you didn't mention "you must keep public visibility", for most users (especially for new users), I always recommend to set to "Private visibility", that's just a widely used approach. And I spent time on testing it for you .....
For the "Privacy" topic, I think Gitea is like most other systems, pretty values it.
For the "security" lie created by Forgejo: Gitea didn't do anything wrong, nothing is exposed ahead. Forgejo catches every chance to attack Gitea.

@wxiaoguang commented on GitHub (Feb 26, 2024): Hopefully won't bother you, but for the whole context, I'd like to say something more (so I started a new comment). First, I sincerely apologize to you for the wording making your unhappy / uncomfortable. Some details: 1. For the issue report: as you know, Forjoge doesn't have a good relation with Gitea, neither with me. Some Forgejo people created too many lies. So, in Gitea space, many Forgejo related topics are difficult to continue. That's why I suggested that "Let's focus on Gitea" 2. Since you didn't mention "you must keep public visibility", for most users (especially for new users), I always recommend to set to "Private visibility", that's just a widely used approach. And I spent time on testing it for you ..... 3. For the "Privacy" topic, I think Gitea is like most other systems, pretty values it. 4. For the "security" lie created by Forgejo: Gitea didn't do anything wrong, nothing is exposed ahead. Forgejo catches every chance to attack Gitea.

GiteaMirror commented

@inferenceus commented on GitHub (Feb 26, 2024):

@jolheiser

it seems partially solved by setting activity to private.

This could be a solution if that's what the user wanted, but it's not what is wanted. I didn't clarify that because I was focused on the issue at hand. Instead of being asked that before anything else was stated, I received a load of nonsense in the apparent form of emotional anti-Forgejo hatred which was completely off-topic when this issue affects Gitea exactly the same.

But the leak is that participating in private actions still updates "recently updated"?

Yes. That's the case when I don't believe it should be. I don't think a user should be forced to set their entire profile activity to private just to prevent people knowing they're using it.

Does the new issue that was opened cover your follow-up comment?

Yes, it seems like it would resolve the issue if implemented.

@inferenceus commented on GitHub (Feb 26, 2024): @jolheiser > it seems partially solved by setting activity to private. This could be a solution if that's what the user wanted, but it's not what is wanted. I didn't clarify that because I was focused on the issue at hand. Instead of being asked that before anything else was stated, I received a load of nonsense in the apparent form of emotional anti-Forgejo hatred which was completely off-topic when this issue affects Gitea exactly the same. > But the leak is that participating in private actions still updates "recently updated"? Yes. That's the case when I don't believe it should be. I don't think a user should be forced to set their entire profile activity to private just to prevent people knowing they're using it. > Does the new issue that was opened cover your follow-up comment? Yes, it seems like it would resolve the issue if implemented.

GiteaMirror commented

@inferenceus commented on GitHub (Feb 26, 2024):

@wxiaoguang

Forjoge doesn't have a good relation with Gitea, neither with me.

Keep emotions out of this. Your attitude was ridiculous. I'm not an emotional person, I'm a logical one. I came here to help you fix a bug in your software, not for me. You treated me as if I was some dumb moron, and I don't appreciate it. I want no interaction with you, but I do want an apology.

@inferenceus commented on GitHub (Feb 26, 2024): @wxiaoguang > Forjoge doesn't have a good relation with Gitea, neither with me. Keep emotions out of this. Your attitude was ridiculous. I'm not an emotional person, I'm a logical one. I came here to help **you** fix a bug in **your** software, not for me. You treated me as if I was some dumb moron, and I don't appreciate it. I want no interaction with you, but I do want an apology.

GiteaMirror commented

@jolheiser commented on GitHub (Feb 26, 2024):

I am unlocking this thread and will be marking various comments as off-topic.
I think the initial request is valid.

Some comments have a mix of info and off-topic, so apologies if my marking was haphazard.

@jolheiser commented on GitHub (Feb 26, 2024): I am unlocking this thread and will be marking various comments as off-topic. I think the initial request is valid. Some comments have a mix of info and off-topic, so apologies if my marking was haphazard.

GiteaMirror commented

@inferenceus commented on GitHub (Feb 26, 2024):

I am unlocking this thread and will be marking various comments as off-topic. I think the initial request is valid.

Firstly, thank you for actually focusing on the issue at hand.

Secondly, although you weren't involved in the intial off-topic heat I had coming my way, I want to reiterate that this is the last time I will be contributing to Gitea in any form, whether it was my first time or not. I've archived this conversation for evidence purposes and will be waiting for an apology. How I was spoken to is no way to treat users, and, for Gitea's information, I had no strong bias towards Forgejo until this incident. I don't know what happened between the 2 projects, but this was enough to sway me their way.

I'd like to help Gitea users whether I use Gitea or not, but I can't willingly tolerate this attitude by the project, so I unfortunately must stay away.

@inferenceus commented on GitHub (Feb 26, 2024): > I am unlocking this thread and will be marking various comments as off-topic. I think the initial request is valid. Firstly, thank you for actually focusing on the issue at hand. Secondly, although you weren't involved in the intial off-topic heat I had coming my way, I want to reiterate that this is the last time I will be contributing to Gitea in any form, whether it was my first time or not. I've archived this conversation for evidence purposes and will be waiting for an apology. How I was spoken to is no way to treat users, and, for Gitea's information, I had no strong bias towards Forgejo until this incident. I don't know what happened between the 2 projects, but this was enough to sway me their way. I'd like to help Gitea users whether I use Gitea or not, but I can't willingly tolerate this attitude by the project, so I unfortunately must stay away.

GiteaMirror commented

@wxiaoguang commented on GitHub (Feb 26, 2024):

I've archived this conversation for evidence purposes and will be waiting for an apology

I have apologized: "First, I sincerely apologize to you for the wording making your unhappy / uncomfortable." https://github.com/go-gitea/gitea/issues/29425#issuecomment-1964516467

Apologize again.

@wxiaoguang commented on GitHub (Feb 26, 2024): > I've archived this conversation for evidence purposes and will be waiting for an apology I have apologized: "First, I sincerely apologize to you for the wording making your unhappy / uncomfortable." https://github.com/go-gitea/gitea/issues/29425#issuecomment-1964516467 Apologize again.

GiteaMirror commented

@inferenceus commented on GitHub (Feb 26, 2024):

I've archived this conversation for evidence purposes and will be waiting for an apology

I have apologized: "First, I sincerely apologize to you for the wording making your unhappy / uncomfortable." .

Apologize again.

Thank you. Make sure it doesn't happen again. It was completely uncalled for. I didn't have to come here since I don't even use Gitea, but I did, because I care. I was not expecting what came to me for trying to help.

@inferenceus commented on GitHub (Feb 26, 2024): > > I've archived this conversation for evidence purposes and will be waiting for an apology > > I have apologized: "First, I sincerely apologize to you for the wording making your unhappy / uncomfortable." . > > Apologize again. Thank you. Make sure it doesn't happen again. It was completely uncalled for. I didn't have to come here since I don't even use Gitea, but I did, because I care. I was not expecting what came to me for trying to help.

GiteaMirror commented

@lunny commented on GitHub (Feb 26, 2024):

Thanks for the contribution anyway. @inferenceus You already did that. :)

Let's back to the issue itself.

I have a different thought. I don't think people know whether a user just log in or did others, he just knows the person has done some activities if he was in the first one sort by recently updated.

So maybe it's not a leak? After all, users don't know what the last activity is for the user.

@lunny commented on GitHub (Feb 26, 2024): Thanks for the contribution anyway. @inferenceus You already did that. :) Let's back to the issue itself. I have a different thought. I don't think people know whether a user just log in or did others, he just knows the person has done some activities if he was in the first one sort by recently updated. So maybe it's not a leak? After all, users don't know what the last activity is for the user.

GiteaMirror commented

@jolheiser commented on GitHub (Feb 26, 2024):

In terms of privacy I think even knowing someone did "something" is related. How significant that is may vary by person.

@jolheiser commented on GitHub (Feb 26, 2024): In terms of privacy I think even knowing someone did "something" is related. How significant that is may vary by person.

GiteaMirror commented

@inferenceus commented on GitHub (Feb 26, 2024):

@lunny

I don't think people know whether a user just log in or did others, he just knows the person has done some activities if he was in the first one sort by recently updated.

So maybe it's not a leak? After all, users don't know what the last activity is for the user.

It is a leak as far as I'm concerned. What use is allowing other people to know that a user logged in or did anything outside of public repositories? Would you want the world to know when you log into your PC and are moving files around etc?

@inferenceus commented on GitHub (Feb 26, 2024): @lunny > I don't think people know whether a user just log in or did others, he just knows the person has done some activities if he was in the first one sort by recently updated. > > So maybe it's not a leak? After all, users don't know what the last activity is for the user. It is a leak as far as I'm concerned. What use is allowing other people to know that a user logged in or did anything outside of public repositories? Would you want the world to know when you log into your PC and are moving files around etc?

GiteaMirror commented

https://try.gitea.io/explore/users?sort=reverselastlogin

@wxiaoguang commented on GitHub (Feb 26, 2024):

I think I find more problems on the "explore user" page. It accepts undocumented arguments:

I guess end users shouldn't care about "lastlogin" or "update time", so I propose to remove all of them.

@wxiaoguang commented on GitHub (Feb 26, 2024): I think I find more problems on the "explore user" page. It accepts undocumented arguments: https://try.gitea.io/explore/users?sort=reverselastlogin I guess end users shouldn't care about "lastlogin" or "update time", so I propose to remove all of them.

GiteaMirror commented

@inferenceus commented on GitHub (Feb 26, 2024):

@wxiaoguang

I guess end users shouldn't care about "lastlogin" or "update time", so I propose to remove all of them.

I personally don't see a use case for this, either. A proposal made by the other project is to remove all sort options from the explore/user page, but I'm unsure if that would solve all of these issues.

@inferenceus commented on GitHub (Feb 26, 2024): @wxiaoguang > I guess end users shouldn't care about "lastlogin" or "update time", so I propose to remove all of them. I personally don't see a use case for this, either. A proposal made by the other project is to remove all sort options from the `explore/user` page, but I'm unsure if that would solve all of these issues.

GiteaMirror commented

@wxiaoguang commented on GitHub (Feb 26, 2024):

Thank you very much for the feedback. I managed to propose a PR: Only use supported sort order for "explore/users" page #29430

For the "remove all sort options", my opinion is written in the PR:

Removing the "sort orders" could also be a good solution, while IMO at the moment keeping the "create time" and "name" orders is also fine, in case some users would like to find a target user in the search result, the "sort order" might help.

@wxiaoguang commented on GitHub (Feb 26, 2024): Thank you very much for the feedback. I managed to propose a PR: Only use supported sort order for "explore/users" page #29430 For the "remove all sort options", my opinion is written in the PR: > Removing the "sort orders" could also be a good solution, while IMO at the moment keeping the "create time" and "name" orders is also fine, in case some users would like to find a target user in the search result, the "sort order" might help.

GiteaMirror commented

@inferenceus commented on GitHub (Feb 26, 2024):

For the "remove all sort options", my opinion is written in the PR:

Removing the "sort orders" could also be a good solution, while IMO at the moment keeping the "create time" and "name" orders is also fine, in case some users would like to find a target user in the search result, the "sort order" might help.

This is actually the best solution I've found so far for those wanting to keep those 2 specific pieces of metadata without privacy issues.

@inferenceus commented on GitHub (Feb 26, 2024): > For the "remove all sort options", my opinion is written in the PR: > > Removing the "sort orders" could also be a good solution, while IMO at the moment keeping the "create time" and "name" orders is also fine, in case some users would like to find a target user in the search result, the "sort order" might help. This is actually the best solution I've found so far for those wanting to keep those 2 specific pieces of metadata without privacy issues.

GiteaMirror commented

@inferenceus commented on GitHub (Feb 26, 2024):

Personally, I'm happy with the result of this issue and the pull request which was created due to it (and, hopefully, merged). Despite the heated beginning, it ended up being productive and solved what some would see as a major issue (for others, minor, but still an issue nonetheless).

Thank you @jolheiser and @wxiaoguang for resolving this issue.

Regarding the off-topic posts, to clarify at this point since it's important and should be concluded after the positive results here

When logic and rationality is used, great things can come of it. There may be people attacking this project, but I'm certainly not one of them, and it's wise to not assume everyone is unless they prove otherwise. I deal with my fair share of misinformation, so I know what it's like if what happens here is true, but I need both sides of the story to decide for myself. Regardless, it seems the developers here are good people when they focus on the issue at hand.

@inferenceus commented on GitHub (Feb 26, 2024): Personally, I'm happy with the result of this issue and the pull request which was created due to it (and, hopefully, merged). Despite the heated beginning, it ended up being productive and solved what some would see as a major issue (for others, minor, but still an issue nonetheless). Thank you @jolheiser and @wxiaoguang for resolving this issue. <details> <summary><b>Regarding the off-topic posts, to clarify at this point since it's important and should be concluded after the positive results here</b></summary> When logic and rationality is used, great things can come of it. There may be people attacking this project, but I'm certainly not one of them, and it's wise to not assume everyone is unless they prove otherwise. I deal with my fair share of misinformation, so I know what it's like if what happens here is true, but I need both sides of the story to decide for myself. Regardless, it seems the developers here are good people when they focus on the issue at hand. </details>

GiteaMirror commented